我正在尝试在 debian 12 上使用带有 dhcp 的 freeradius。我正在从路由器中继 DHCP 数据包。
- 使用 DHCP 监听端口 67 的 FR 设置：freeradius -X 工作正常，正如预期的那样。但 systemd 无法启动服务。不幸的是，我找不到任何相关日志可以查看。我只能看到那里：
root@rpi:~# journalctl -xeu freeradius.service
Jul 26 13:09:41 rpi freeradius[544893]: rlm_sql (sql): Adding client ubiqap (UbiQ_AP) to global clients list
Jul 26 13:09:41 rpi freeradius[544893]: rlm_sql (192.168.220.55): Client "UbiQ_AP" (sql) added
Jul 26 13:09:41 rpi freeradius[544893]: rlm_sql (sql): Released connection (0)
Jul 26 13:09:41 rpi freeradius[544893]: rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output
Jul 26 13:09:41 rpi freeradius[544893]: rlm_mschap (mschap): using internal authentication
Jul 26 13:09:41 rpi freeradius[544893]: tls: Using cached TLS configuration from previous invocation
Jul 26 13:09:41 rpi freeradius[544893]: tls: Using cached TLS configuration from previous invocation
Jul 26 13:09:41 rpi freeradius[544893]: Compiling dhcp DHCP-Discover for attr DHCP-Message-Type
Jul 26 13:09:41 rpi freeradius[544893]: Compiling dhcp DHCP-Request for attr DHCP-Message-Type
Jul 26 13:09:41 rpi freeradius[544893]: Compiling dhcp DHCP-Decline for attr DHCP-Message-Type
Jul 26 13:09:41 rpi freeradius[544893]: Compiling dhcp DHCP-Inform for attr DHCP-Message-Type
Jul 26 13:09:41 rpi freeradius[544893]: Compiling dhcp DHCP-Release for attr DHCP-Message-Type
Jul 26 13:09:41 rpi freeradius[544893]: Compiling dhcp DHCP-Lease-Query for attr DHCP-Message-Type
Jul 26 13:09:41 rpi freeradius[544893]: Compiling Auth-Type PAP for attr Auth-Type
Jul 26 13:09:41 rpi freeradius[544893]: Compiling Auth-Type CHAP for attr Auth-Type
Jul 26 13:09:41 rpi freeradius[544893]: Compiling Auth-Type MS-CHAP for attr Auth-Type
Jul 26 13:09:41 rpi freeradius[544893]: Ignoring "ldap" (see raddb/mods-available/README.rst)
Jul 26 13:09:41 rpi freeradius[544893]: Compiling Post-Auth-Type REJECT for attr Post-Auth-Type
Jul 26 13:09:41 rpi freeradius[544893]: Compiling Auth-Type PAP for attr Auth-Type
Jul 26 13:09:41 rpi freeradius[544893]: Compiling Auth-Type CHAP for attr Auth-Type
Jul 26 13:09:41 rpi freeradius[544893]: Compiling Auth-Type MS-CHAP for attr Auth-Type
Jul 26 13:09:41 rpi freeradius[544893]: Compiling Autz-Type New-TLS-Connection for attr Autz-Type
Jul 26 13:09:41 rpi freeradius[544893]: Compiling Post-Auth-Type REJECT for attr Post-Auth-Type
Jul 26 13:09:41 rpi freeradius[544893]: Compiling Post-Auth-Type Challenge for attr Post-Auth-Type
Jul 26 13:09:41 rpi freeradius[544893]: Compiling Post-Auth-Type Client-Lost for attr Post-Auth-Type
Jul 26 13:09:41 rpi freeradius[544893]: radiusd: #### Skipping IP addresses and Ports ####
Jul 26 13:09:41 rpi freeradius[544893]: Configuration appears to be OK
Jul 26 13:09:42 rpi systemd[1]: freeradius.service: Main process exited, code=exited, status=1/FAILURE
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░
░░ An ExecStart= process belonging to unit freeradius.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 1.
Jul 26 13:09:42 rpi systemd[1]: freeradius.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░
░░ The unit freeradius.service has entered the 'failed' state with result 'exit-code'.
Jul 26 13:09:42 rpi systemd[1]: Failed to start freeradius.service - FreeRADIUS multi-protocol policy server.
░░ Subject: A start job for unit freeradius.service has failed
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░
░░ A start job for unit freeradius.service has finished with a failure.
░░
░░ The job identifier is 4265304 and the job result is failed.
- 我将 DHCP 监听端口设置为非标准 6700，systemctl 可以毫无问题地启动 FR。
希望是用户权限问题，但找不到正确的路径继续。我试过了，root@rpi:~# setcap cap_net_admin=ei /usr/sbin/freeradius但没有任何效果。
答案1
好吧，经过几个小时的挖掘，发现这是功能问题。在 /usr/lib/systemd/system/freeradius.service 中执行# setcap "CAP_NET_BIND_SERVICE=ep" /usr/sbin/freeradius并AmbientCapabilities=CAP_NET_RAW设置。这使得一切都按预期运行。